Call us now:
A great post Ted Dziekanowski. Are we starting to see a trend with rising class actions focused upon cybersecurity and data breaches. With Data privacy and cybersecurity class action suits continue to represent the largest share of annual class action filings in New England to date. While New England is a microcosm of the U.S judicial system, we do know that along with the FTCs position on cyber, HIPAA and a lesser degree GDPR present plaintiffs with a seam of regulation to focus on data breach’s, specifically for PII.
However the the SEC final cyber rule effective 5th September may change the game, albeit for SEC registrants. It requires covered registrants demonstrate management of material cybersecurity risk of every data class, setting out requirements for board governance, oversight and assurance and the management of material cyber risks.
One suspects that a plaintiff could find it easier to demonstrate ‘alleged harm’ under the SEC rule. As the role of a reasonable investor, the management of material cyber risk, the disclosure of material cyber incidents and the registrants ability to demonstrate ‘adequate’ compliance set the bar by which both plaintiffs and defendants must demonstrate compliance. Add to this the facts that registrants are required to provide data annually on their material cybersecurity risk management; they are effected by supply chain cyber attacks; they must disclose material cyber incidents; the SEC ruling will likely effect D&O and cyber insurance, and the rise in cyber risk regulation (EU NIS 2, DORA, CRA),
Class actions focused on cybersecurity risk management may continue to rise as a function of the ability of covered organizations to demonstrate they can manage cyber risk and incidents.
Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberregulation #classactionlawsuit
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7106571745444147200